The email was sent on 2017-04-21 05:33:23 and appeared to be from email@example.com but this address could have been spoofed.
If you replied to this email, your reply would have been sent to firstname.lastname@example.org which was the scammer's actual email address.
It was probably sent from 18.104.22.168 in Shenzhen, China
Explains what each bit of the header means, and shows the journey the email took. Click here to show or hide it
|X-Apparently-To:||Used when there is no 'to' field in the header, does the same thing (says what email address(es) the email is sent to||[email address removed] Fri, 21 Apr 2017 02:33:22 +0000|
|Return-Path:||The address the email was sent from, or at least the one this email should be 'bounced' back to if it can not be delivered. Often spammers and scammers modify the email header to set a different return-path||[email address removed]|
|X-YahooFilteredBulk:||The IP here was blacklisted by Yahoo for sending spam||22.214.171.124|
|Received-SPF:||Returns 'pass' if the email was sent legitimately, 'neutral' if the server thinks nothing is right or wrong, 'soft fail' if it's not a serious issue, 'fail' if the email was sent by an unauthorised user or IP address (often if the mail server is hacked into), 'none' if the server can't tell, 'permerror' if the mail client does not understand what the server is saying, 'temperror' if the client can't connect to the server. More info||softfail (transitioning domain of szsimentor.com does not designate 126.96.36.199 as permitted sender)|
|X-YMailISG:||A unique ID added by the Yahoo Inbound Spam Guard||OQ2c318WLDuBkaIWMPso2IXNTTIB4ivEvZoWAX4P0anw4__E H_oFHso6t.uHQ48TG98owmsufyjnDMaRj.cQSj2bkXwkAvvan_TeR3rJDrQD ckis57YqAaQB7f3TTVH9xKHnDAbSVKPPM3XF5E0o_np9T2NaXvhiiOv_.Dpk dFbfqApsWbpqzUvjhXeTOZAW8_Il4iVuqNWf92aZ_R2vDEQjGOnZCXkqvoPw 6hGZIBNZLeUSvnHBC8lGSRFAqi2uVg.sh_5t8llkydWVASv7pJRaXdSkptxE 23rExreNbUs.zJUWWcpLMZnuPZWw2QfkS.U6tl7SGVE1cxuEZe1bcWmPxx4. qV9bmrwXryi0NXtdiPQY8Xgr_EvIBwc92jN8SpxCxiw.kVUJq44YyJM6zRLp H.335UDMK7yNcckVAcaGKQ1yyZCDgyZHLrgjR07QWWe4Z2EoNoY5rldYuIF2 ItI09wzsY_r9WfO.bV7NUl.IU_DRs..dS7JDttLUuCk0JQ_.Pf9DteLfieZv IcRGjWLEp8oDZjdCIqQisToULrkd1lYOisUu9s_IDntdsGzLsZxHkMjUHC_4 KIE9fLDyB3_Pdqs9SB72utbLaDTo8EKzQ9fOiK.OEeYDTuH1ImnT2_W0uI4n veBYPA6jV4kQL2VDP0NpuYb85Iq0PjHHbzQ8Ta5zYmgj7KQDZkgNVgBHI617 1Y8YNILmDYHxYL8QLh6mLFN.rEPMdbZd_s41f5lxGJ24BjVt3iFZvmXDS4fI ROBgB3cVMj7R781aPTcHCUKXwPrdBhVPGKQ66Gronu46l7wg3coLWnnPwxqA SRcqlujmbqIDA79IToo4Np3eq7cU9pi1zFAzuK7ShK5pZuqUOlqZwFggnRzA 7TYcwN8R9Y7uSX2tsc1SsljJ2vh_MTBANmTk_q3CWuPeXsv5E5Fd8cgQzAv7 2gS.ZCn1Wc9M7_IyAcIFnCJ6DClVEL1nMfaEQ0qCukB4JUUl9bqiF99czmuF 3Qr6.eHnq2T.SIdZTMnVi81iCegCtcS_yYs34Uw7X2Ij05lYLPk_mZu5DD1d 63UZvwaHQ8PJE.KyEJ3uvuzcyRwvQ4UIcFMEYh375Z74JmsyxMNzxXQBMh6L wszJHJ2yZD3HBbnGoHkdqZ0jRxl0fkgeW0EblUdY5Boeb7d89SDZc_dbfDvL ghVL95K3DZNPduwH9NaBxQ7G6Ik9bqIg1xygrJkknMiqc.E3xqqklQm4_NFR 2B8TEsY_dKOpPOoY9TtO8d0UY7bOROpDnGPAopADISbBNeH98V2pjr0204hZ i4TnbGVq4is.O4XNveEYfHtA9.uVu2SAMKvR7ox3M0cw0aIO2gpIKhkGh3TA B0tMcl781Rsd0PUewDQUdn_EFFxMQ3qvFvLaD7LqABY371rkjarj8PNhHWuN hPcyvqmYpUheYmLdIBC05m4_9PBWWl3Bq.BQD_HUAuGQwNoZoFYpL7MgVgeH OB33cY1YPFb4HLIh4dpMQBY-|
|X-Originating-IP:||The IP address the email was originally sent from, sometimes wrong - the bottom 'Received' field in the email header is the most reliable indicator of what IP the email came from||[188.8.131.52]|
|Authentication-Results:||Returns the result given in the Received-SPF field, and says spf=pass if the email passed authentication. Also uses the DKIM signature, and equally returns dkim=pass if the DKIM signature was okay. More info||mta1532.mail.ne1.yahoo.com from=szsimentor.com; domainkeys=neutral (no sig); from=szsimentor.com; dkim=neutral (no sig)|
|Received:||Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took||from 127.0.0.1 (HELO szsimentor.com) (184.108.40.206) by mta1532.mail.ne1.yahoo.com with SMTP; Fri, 21 Apr 2017 02:33:22 +0000|
|Received:||Part of the journey the email took to reach us/you, these tend to be in the order bottom-to-top so the first 'Received' is the last step the email took and the last 'Received' is the first step the email took||from ppzlocpxh[127.0.0.1] by DELL[127.0.0.1] (SMTPD32); Fri, 21 Apr 2017 00:51:04 +0800|
|Reply-To:||This is the email address any reply would be sent to by default||[email address removed]|
|Date:||The date/time the email was sent||Fri, 21 Apr 2017 00:50:56 +0800|
|From:||This is the address the email was apparently sent from||"Electronic component supplier" [email address removed]|
|To:||The email address(es) the email was sent to||[email address removed]|
|Subject:||The subject of the email||sscatcher Electronic market by your side- Simentor 2017/4/21|
|Message-ID:||A unique ID assigned to the ID for reference purposes||[email address removed]|
|X-mailer:||Software used to send the email||Foxmail 6, 13, 102, 15 [cn]|
|Mime-Version:||Included, usually 1.0, if the email or header contains any non-ASCII characters or non-text attachments, or if the email is multi-part (contains a plain text version plus an HTML one, lets the user's email client or webmail decide which version to display)||1.0|
|Content-Type:||What type of content the email usually is, usually text/html, and what character set is used||multipart/related; type="multipart/alternative"; boundary="=====003_Dragon074533177585_====="|
|Content-Length:||The size of the email, in bytes||129275|
Do you enquire of all kinds of Electronic components？
We are a leading independent electronic components distributor from China.
Special prices for items :
Need help finding a part? We can help!
Waiting for your contact to discuss the possible deal. Thanks.
Simentor Electronic Limited.
pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: scammed.by] 0.0 TVD_RCVD_IP4 Message was received from an IPv4 address 0.0 TVD_RCVD_IP Message was received from an IP address 1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL, https://senderscore.org/blacklistlookup/ [220.127.116.11 listed in bl.score.senderscore.com] 0.0 RCVD_IN_SORBS_DUL RBL: SORBS: sent directly from dynamic IP address [18.104.22.168 listed in dnsbl.sorbs.net] 3.6 RCVD_IN_PBL RBL: Received via a relay in Spamhaus PBL [22.214.171.124 listed in zen.spamhaus.org] 1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail) 0.9 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail) 0.0 MISSING_MIME_HB_SEP BODY: Missing blank line between MIME header and body
Please be careful with the links in the above email - Scammed.by strongly suggests that you do not click on any links in the above message
The email above is most likely a scam but every now and then legitimate emails do come through, as do spam emails which are not attempting to defraud, so please use your judgement
You can contact ScamSearch at help at scammed.by for any information, help, or if you have spotted a legitimate email. Please link to the email you think is legitimate.
ScamSearch does not accept any responsibility for visitors enduring any issues as a result of following links in the above email and/or contacting the sender
Please do not contact the sender unless you know what you are doing (i.e. experienced scambaiters)